1039124 matches found
UBUNTU-CVE-2022-50814
In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/zip - fix mismatch in get/set sglsgenr KASAN reported this Bug: 17619.659757 BUG: KASAN: global-out-of-bounds in paramgetint+0x34/0x60 17619.673193 Read of size 4 at addr fffff01332d7ed00 by task readall/1507958...
CVE-2023-54317
CVE-2023-54317 – Linux kernel dm-flakey zero-page corruption fixed Root cause: When zeroing a range on a block device, dm-flakey could submit a write bio whose bio vector pointed to the zero page, and if corrupt bio writes were enabled it could corrupt the zero page, causing crashes because users...
CVE-2023-54283
In the Linux kernel, the following vulnerability has been resolved: bpf: Address KCSAN report on bpflrulist KCSAN reported a data-race when accessing node-ref. Although node-ref does not have to be accurate, take this chance to use a more common READONCE and WRITEONCE pattern instead of datarace...
CVE-2023-54282
CVE-2023-54282 affects the Linux kernel driver media/tuners/qt1010 (qt1010.c). The vulnerability arises from a buffer overflow in qt1010_init() where i2c_data overflow was flagged (34
CVE-2022-50876 usb: musb: Fix musb_gadget.c rxstate overflow bug
In the Linux kernel, the following vulnerability has been resolved: usb: musb: Fix musbgadget.c rxstate overflow bug The usb function device call musbgadgetqueue adds the passed request to musbep::reqlist,If the request-length musbep-packetsz and isbuffermappedreq return false,the rxstate will co...
CVE-2023-54265
CVE-2023-54265 affects the Linux kernel: an uninit variable access in __ip6_make_skb() can occur when icmp6hdr is not in the skb’s linear region (notably with SOCK_RAW); the fix uses a local icmp6_type to carry the correct value across scenarios. Public advisories from multiple vendors (Red Hat, ...
CVE-2023-54265 ipv6: Fix an uninit variable access bug in __ip6_make_skb()
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix an uninit variable access bug in ip6makeskb Syzbot reported a bug as following: ===================================================== BUG: KMSAN: uninit-value in archatomic64inc arch/x86/include/asm/atomic6464.h:88 inli...
CVE-2023-54265
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix an uninit variable access bug in ip6makeskb Syzbot reported a bug as following: ===================================================== BUG: KMSAN: uninit-value in archatomic64inc arch/x86/include/asm/atomic6464.h:88 inli...
CVE-2023-54258
CVE-2023-54258: In the Linux kernel CIFS code, a race between deferred closes and lease breaks can cause an unmount (kill_sb) to occur before validating tcon->ses during oplock_response, risking a use-after-free. The fix is to reorder checks before sending oplock_response: first ensure openFil...
CVE-2023-54253 btrfs: set page extent mapped after read_folio in relocate_one_page
In the Linux kernel, the following vulnerability has been resolved: btrfs: set page extent mapped after readfolio in relocateonepage One of the CI runs triggered the following panic assertion failed: PagePrivatepage && page-private, in fs/btrfs/subpage.c:229 ------------ cut here ------------...
CVE-2023-54253
The CVE describes a Linux kernel bug in Btrfs relocation: calling set_page_extent_mapped before validating the folio/page can trigger a kernel BUG during relocate_one_page. The fix, as noted in the description, is to move set_page_extent_mapped to after the btrfs_read_folio block so the subpage b...
CVE-2022-50856
The CVE-2022-50856 entry applies to the Linux kernel, specifically the CIFS subsystem. The vulnerability was caused by an xid leak in cifs_ses_add_channel() where the xid was not freed before returning. A fix was applied to ensure the xid is freed, mitigating the leak. Affected versions/contexts ...
CVE-2023-54243 netfilter: ebtables: fix table blob use-after-free
In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: fix table blob use-after-free We are not allowed to return an error at this point. Looking at the code it looks like ret is always 0 at this point, but its not. t = findtablelocknet, repl-name, &ret, &ebtmute...
CVE-2023-54234 scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization
In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix missing mrioc-evtackcmds initialization Commit c1af985d27da "scsi: mpi3mr: Add Event acknowledgment logic" introduced an array mrioc-evtackcmds but initialization of the array elements was missed. They are just...
CVE-2023-54234 scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization
In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix missing mrioc-evtackcmds initialization Commit c1af985d27da "scsi: mpi3mr: Add Event acknowledgment logic" introduced an array mrioc-evtackcmds but initialization of the array elements was missed. They are just...
CVE-2022-50841
The CVE covers a Linux kernel NTFS3 parsing flaw: when parsing MFT attributes, an overflow in the attribute size calculation could let Add2Ptr(attr, asize) exceed bounds, enabling an out-of-bounds memory R/W. The issue has been mitigated by adding an overflow check for attribute sizes in fs/ntfs3...
CVE-2022-50839 jbd2: fix potential buffer head reference count leak
In the Linux kernel, the following vulnerability has been resolved: jbd2: fix potential buffer head reference count leak As in 'jbd2fcwaitbufs' if buffer isn't uptodate, will return -EIO without update 'journal-jfcoff'. But 'jbd2fcreleasebufs' will release buffer head from ‘jfcoff - 1’ if 'bh' is...
CVE-2022-50828
CVE-2022-50828 affects the Linux kernel clock driver for ZynqMP (clk: zynqmp). The issue caused a stack-out-of-bounds access in strncpy during probe-time when the clock name exceeds 15 bytes, leading to a missing NUL terminator in the 16-byte SMC payload path used by Linux-ATF. The KSAN violation...
CVE-2022-50828
In the Linux kernel, the following vulnerability has been resolved: clk: zynqmp: Fix stack-out-of-bounds in strncpy "BUG: KASAN: stack-out-of-bounds in strncpy+0x30/0x68" Linux-ATF interface is using 16 bytes of SMC payload. In case clock name is longer than 15 bytes, string terminated NULL...